API keys and authentication

Every request carries an API key. Keys belong to a workspace and spend its balance; each can be held to its own budgets, models and addresses.

Sending the key

Either header works on every endpoint:

Authorization: Bearer zr_live_your_key_here
# or, as Anthropic's SDKs send it:
x-api-key: zr_live_your_key_here

Keys start with zr_live_. You see the full key once, when you create it; we only keep a hash, so nobody (us included) can show it to you again. Lost it? Revoke it and make another.

Keeping keys safe

• Keep keys in a secret manager or environment variables, never in code or a repository.
• Call zurelay from your server. A key in a browser or a mobile app can be read by anyone who has the app.
• Use one key per app or environment (say, production and staging), so you can revoke one without touching the others.
• Give each key only what it needs: a budget, the models it calls, the addresses it runs on. See Key limits and rules.
• If a key leaks, revoke it under API keys. Requests with it stop within 15 seconds.

What a key can be held to

Authentication errors